Cyber Risk Management: The Impact of Data in the Assessment of Cyber Risk by Cyber Insurers

Abstract

In the effort to mitigate cyber risk, cyber insurers are confronted with several challenges the most prominent of which is lack, shortage, or unavailability of data for risk identification, risk assessment and valuation, and estimation of the consequences of cyber incidents. This problem is largely occasioned by the fact that the sphere of cyber risk is evolving, and organisations are unwilling to share information on cyber incidents because of the fear of being exposed to further attacks and reputational damage. Consequently, this work establishes that discretion should be exercised by businesses in ensuring that only relevant and risk-averse details are shared. With adequate data, cyber insurers can develop viable insurance products that meet the need of the market, identify, differentiate and assess cyber risk, set the right premium, estimate claims payout in the event of an incident, clear the uncertainties about cyber insurance business and give the business wide acceptance from organisations because of the level of information at their disposal, which can be utilized to advance the business of cyber insurance. Finally, this work establishes that information sharing also impacts organisations by helping to reveal corporate compliance lapses during questioning by cyber insurers.

Keywords: cyber risk, cyber risk management, cyber insurance, cyber risk assessment, cyber incident sharing

JEL Classification: G22, G32, L11